{"kind": "product", "path": "vulns/ubuntu-20.04-lts/xorg-server", "name": "xorg-server", "product": "xorg-server", "ecosystem": "Ubuntu:20.04:LTS", "items": [{"id": "CVE-2025-26601", "noindex": false, "published": "2025-02-25T15:55:36.775Z", "modified": "2026-06-29T20:37:18.761Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00393, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-26601", "title": "Xorg: xwayland: use-after-free in syncinittrigger()", "description": "A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.", "references": ["https://access.redhat.com/errata/RHSA-2025:2500", "https://access.redhat.com/errata/RHSA-2025:2502", "https://access.redhat.com/errata/RHSA-2025:2861"], "fixes": ["2:1.20.13-1ubuntu1~20.04.19"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2025-26600", "noindex": false, "published": "2025-02-25T15:55:20.421Z", "modified": "2026-06-29T20:37:14.207Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00393, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-26600", "title": "Xorg: xwayland: use-after-free in playreleasedevents()", "description": "A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.", "references": ["https://access.redhat.com/errata/RHSA-2025:2500", "https://access.redhat.com/errata/RHSA-2025:2502", "https://access.redhat.com/errata/RHSA-2025:2861"], "fixes": ["2:1.20.13-1ubuntu1~20.04.19"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2025-26599", "noindex": false, "published": "2025-02-25T15:55:02.964Z", "modified": "2026-06-29T20:37:09.429Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00405, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-26599", "title": "Xorg: xwayland: use of uninitialized pointer in compredirectwindow()", "description": "An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.", "references": ["https://access.redhat.com/errata/RHSA-2025:2500", "https://access.redhat.com/errata/RHSA-2025:2502", "https://access.redhat.com/errata/RHSA-2025:2861"], "fixes": ["2:1.20.13-1ubuntu1~20.04.19"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2025-26598", "noindex": false, "published": "2025-02-25T15:54:57.355Z", "modified": "2026-06-29T20:37:04.249Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00405, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-26598", "title": "Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()", "description": "An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.", "references": ["https://access.redhat.com/errata/RHSA-2025:2500", "https://access.redhat.com/errata/RHSA-2025:2502", "https://access.redhat.com/errata/RHSA-2025:2861"], "fixes": ["2:1.20.13-1ubuntu1~20.04.19"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2025-26597", "noindex": false, "published": "2025-02-25T15:54:48.196Z", "modified": "2026-06-29T20:36:58.935Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00444, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-26597", "title": "Xorg: xwayland: buffer overflow in xkbchangetypesofkey()", "description": "A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.", "references": ["https://access.redhat.com/errata/RHSA-2025:2500", "https://access.redhat.com/errata/RHSA-2025:2502", "https://access.redhat.com/errata/RHSA-2025:2861"], "fixes": ["2:1.20.13-1ubuntu1~20.04.19"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2025-26596", "noindex": false, "published": "2025-02-25T15:54:23.693Z", "modified": "2026-06-29T20:36:50.277Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00438, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-26596", "title": "Xorg: xwayland: heap overflow in xkbwritekeysyms()", "description": "A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.", "references": ["https://access.redhat.com/errata/RHSA-2025:2500", "https://access.redhat.com/errata/RHSA-2025:2502", "https://access.redhat.com/errata/RHSA-2025:2861"], "fixes": ["2:1.20.13-1ubuntu1~20.04.19"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2025-26595", "noindex": false, "published": "2025-02-25T15:54:06.708Z", "modified": "2026-06-29T20:36:45.142Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00438, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-26595", "title": "Xorg: xwayland: buffer overflow in xkbvmodmasktext()", "description": "A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.", "references": ["https://access.redhat.com/errata/RHSA-2025:2500", "https://access.redhat.com/errata/RHSA-2025:2502", "https://access.redhat.com/errata/RHSA-2025:2861"], "fixes": ["2:1.20.13-1ubuntu1~20.04.19"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2025-26594", "noindex": false, "published": "2025-02-25T15:53:51.324Z", "modified": "2026-06-29T20:36:40.333Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00393, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-26594", "title": "X.org: xwayland: use-after-free of the root cursor", "description": "A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.", "references": ["https://access.redhat.com/errata/RHSA-2025:2500", "https://access.redhat.com/errata/RHSA-2025:2502", "https://access.redhat.com/errata/RHSA-2025:2861"], "fixes": ["2:1.20.13-1ubuntu1~20.04.19"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2024-9632", "noindex": false, "published": "2024-10-30T07:42:35.320Z", "modified": "2026-03-18T16:01:01.402Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00903, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-9632", "title": "Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability", "description": "A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation in distributions where the X.org server is run with root privileges.", "references": ["https://access.redhat.com/errata/RHSA-2024:10090", "https://access.redhat.com/errata/RHSA-2024:8798", "https://access.redhat.com/errata/RHSA-2024:9540"], "fixes": ["2:1.20.13-1ubuntu1~20.04.18"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2024-31083", "noindex": false, "published": "2024-04-05T12:04:49.414Z", "modified": "2025-11-20T07:19:07.523Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01859, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-31083", "title": "Xorg-x11-server: use-after-free in procrenderaddglyphs", "description": "A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request.", "references": ["https://access.redhat.com/errata/RHSA-2024:1785", "https://access.redhat.com/errata/RHSA-2024:2036", "https://access.redhat.com/errata/RHSA-2024:2037"], "fixes": ["2:1.20.13-1ubuntu1~20.04.17"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2024-31082", "noindex": false, "published": "2024-04-04T13:48:34.893Z", "modified": "2025-11-20T07:19:02.338Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "severity": "high", "epss": 0.00338, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-31082", "title": "Xorg-x11-server: heap buffer overread/data leakage in procappledricreatepixmap", "description": "A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored i", "references": ["https://access.redhat.com/security/cve/CVE-2024-31082", "https://bugzilla.redhat.com/show_bug.cgi?id=2271999", "https://lists.x.org/archives/xorg-announce/2024-April/003497.html"], "fixes": ["2:1.20.13-1ubuntu1~20.04.16"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2024-31081", "noindex": false, "published": "2024-04-04T13:48:12.848Z", "modified": "2025-11-20T07:19:00.688Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "severity": "high", "epss": 0.00517, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-31081", "title": "Xorg-x11-server: heap buffer overread/data leakage in procxipassivegrabdevice", "description": "A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in", "references": ["https://access.redhat.com/errata/RHSA-2024:1785", "https://access.redhat.com/errata/RHSA-2024:2036", "https://access.redhat.com/errata/RHSA-2024:2037"], "fixes": ["2:1.20.13-1ubuntu1~20.04.16"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2024-31080", "noindex": false, "published": "2024-04-04T13:47:33.926Z", "modified": "2025-11-20T07:18:58.383Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H", "severity": "high", "epss": 0.00517, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-31080", "title": "Xorg-x11-server: heap buffer overread/data leakage in procxigetselectedevents", "description": "A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in", "references": ["https://access.redhat.com/errata/RHSA-2024:1785", "https://access.redhat.com/errata/RHSA-2024:2036", "https://access.redhat.com/errata/RHSA-2024:2037"], "fixes": ["2:1.20.13-1ubuntu1~20.04.16"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2024-21886", "noindex": false, "published": "2024-02-28T12:13:12.555Z", "modified": "2025-11-06T20:53:28.237Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0142, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-21886", "title": "Xorg-x11-server: heap buffer overflow in disabledevice", "description": "A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments.", "references": ["https://access.redhat.com/errata/RHSA-2024:0320", "https://access.redhat.com/errata/RHSA-2024:0557", "https://access.redhat.com/errata/RHSA-2024:0558"], "fixes": ["2:1.20.13-1ubuntu1~20.04.14"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2024-21885", "noindex": false, "published": "2024-02-28T12:11:59.650Z", "modified": "2025-11-06T20:53:28.030Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0142, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-21885", "title": "Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent", "description": "A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments.", "references": ["https://access.redhat.com/errata/RHSA-2024:0320", "https://access.redhat.com/errata/RHSA-2024:0557", "https://access.redhat.com/errata/RHSA-2024:0558"], "fixes": ["2:1.20.13-1ubuntu1~20.04.14"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2024-0229", "noindex": false, "published": "2024-02-09T06:29:51.542Z", "modified": "2025-11-06T20:51:57.196Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01229, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-0229", "title": "Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access", "description": "An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments.", "references": ["https://access.redhat.com/errata/RHSA-2024:0320", "https://access.redhat.com/errata/RHSA-2024:0557", "https://access.redhat.com/errata/RHSA-2024:0558"], "fixes": ["2:1.20.13-1ubuntu1~20.04.14"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "USN-6587-3", "noindex": true, "published": "2024-01-30T12:50:20Z", "modified": "2026-04-22T10:43:53.784131Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/usn-6587-3", "title": "xorg-server, xwayland regression", "description": "USN-6587-1 fixed vulnerabilities in X.Org X Server. The fix was incomplete\nresulting in a possible regression. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled\n memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs. An\n attacker could possibly use this issue to cause the X Server to crash,\n obtain sensitive information, or execute arbitrary code. (CVE-2023-6816)\n \n Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled\n reattaching to a different master device. An attacker could use this iss", "references": ["https://ubuntu.com/security/notices/USN-6587-3", "https://launchpad.net/bugs/2051536", "https://osv.dev/vulnerability/USN-6587-3"], "fixes": ["2:1.20.13-1ubuntu1~20.04.15"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2024-0409", "noindex": false, "published": "2024-01-18T15:40:22.071Z", "modified": "2025-11-20T07:09:01.279Z", "cvss": 7.8, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00356, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-0409", "title": "Xorg-x11-server: selinux context corruption", "description": "A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.", "references": ["https://access.redhat.com/errata/RHSA-2024:0320", "https://access.redhat.com/errata/RHSA-2024:2169", "https://access.redhat.com/errata/RHSA-2024:2170"], "fixes": ["2:1.20.13-1ubuntu1~20.04.14"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2024-0408", "noindex": false, "published": "2024-01-18T15:40:06.955Z", "modified": "2025-11-20T07:08:59.547Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00321, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-0408", "title": "Xorg-x11-server: selinux unlabeled glx pbuffer", "description": "A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.", "references": ["https://access.redhat.com/errata/RHSA-2024:0320", "https://access.redhat.com/errata/RHSA-2024:2169", "https://access.redhat.com/errata/RHSA-2024:2170"], "fixes": ["2:1.20.13-1ubuntu1~20.04.14"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}, {"id": "CVE-2023-6816", "noindex": false, "published": "2024-01-18T04:31:07.908Z", "modified": "2026-03-19T21:23:24.417Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.02106, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-6816", "title": "Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer", "description": "A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.", "references": ["https://access.redhat.com/errata/RHSA-2024:0320", "https://access.redhat.com/errata/RHSA-2024:0557", "https://access.redhat.com/errata/RHSA-2024:0558"], "fixes": ["2:1.20.13-1ubuntu1~20.04.14"], "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}]}], "total": 48, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "xorg-server", "path": "vulns/ubuntu-20.04-lts/xorg-server", "ecosystem": "Ubuntu:20.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-06-29T20:37:18.761Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}